In this lesson,
we will learn about privacy risk considerations.
Privacy risk encompasses the potential
for unauthorized access, disclosure,
or misuse of personal or sensitive information.
Privacy risk considerations include the use of biometrics,
data subject rights, and data sovereignty.
Let's explore each of these privacy risk considerations
in more detail.
First, we have considerations specific to biometric data.
Biometrics include technologies such as fingerprint scans,
facial recognition, iris scans, and voice recognition.
Biometric verification systems play an important role
in identity verification,
but also introduce privacy risks due to the highly sensitive
and permanent nature of the biometric data they use.
Additionally, not all biometric systems offer the same level
of security or accuracy.
In assessing biometric systems,
two key metrics should be considered,
the False Acceptance Rate,
which measures how often unauthorized individuals
are mistakenly identified as legitimate users,
and the False Rejection Rate,
which tracks how often legitimate users
are wrongly denied access.
Balancing these rates is essential.
If the false acceptance rate is too high,
security is at risk
because unauthorized users may gain access.
Conversely, if the false rejection rate is too high,
legitimate users will be denied access.
To fine-tune this balance,
biometric sensitivity is adjusted.
When sensitivity is adjusted on a biometric system,
the false acceptance rate
and false rejection rate behave in opposite ways.
As sensitivity level increases,
the system becomes more strict,
causing the false rejection rate to rise.
At the same time, the false acceptance rate decreases
because the system is more selective in granting access.
Conversely, when the sensitivity level is lowered,
the system becomes more lenient,
reducing the false rejection rate,
but increasing the false acceptance rate.
The Crossover Error Rate or CER
is the point where the false acceptance rate
and false rejection rates are equal.
On a graph, this is where the false acceptance rate
and false rejection rate curves intersect.
System sensitivity should be adjusted
to a point near the crossover error rate,
where the false acceptance rate
and the false rejection rate errors are minimized,
ensuring both security and user convenience.
Second, we have data subject rights.
Data subject rights are legal protections
that allow individuals control
over their personal information data.
Subject rights are outlined in various privacy laws,
such as the General Data Protection Regulation or GDPR,
the California Consumer Privacy Act, or CCPA
and the New York SHIELD Act,
where SHIELD stands for Stop Hacks
and Improve Electronic Data Security.
Under GDPR, individuals can access, correct, delete,
and transfer their personal data,
and they must be told how an organization intends
to use their collected data before it is collected.
Similarly, the CCPA provides California residents
with the right to know what data is being collected.
In addition, they could request that their data be deleted
and opt out of any sale of their data.
New York's SHIELD Act focuses on data security,
ensuring organizations take reasonable steps
to protect personal data
and notify individuals in the event of a breach.
These laws empower individuals who are referred to
as the data subjects by providing them
with the tools and rights to control
how their personal information is collected,
used, and shared.
Third, we have data sovereignty.
Data sovereignty refers to the principle
that data is subject to the laws and regulations
of the country in which it is collected and/or stored.
This means that organization must follow
the legal frameworks of both the country
where the data originates
and where it is eventually stored or processed.
For instance,
under the General Data Protection Regulation or GDPR,
personal data collected
from European Union citizens must comply
with GDPR requirements,
even if the data is stored outside of the European Union.
If an American company collects data from European customers
and stores it on servers in the US,
that data is still subject to GDPR regulations.
This adds complexity for multinational companies that need
to ensure compliance with multiple legal standards.
So data sovereignty ensures that data is handled responsibly
and in accordance with local privacy laws
regardless of where it is stored or processed.
To better understand the complexity
of privacy risk considerations,
let's take a look at the 2019 BioStar 2 Data Breach.
The BioStar 2 data breach raised concerns about biometrics,
data subject rights, and data sovereignty.
It exposed over 27.8 million biometric records,
including fingerprints and facial recognition data.
As biometric data is a permanent identifier,
its exposure poses serious long-term risks.
Under the General Data Protection Regulation or GDPR,
this type of data is classified
as a special category of data,
requiring stronger safeguards
to prevent unauthorized access.
This breach also highlighted questions
about whether Suprema,
the company behind BioStar 2,
had complied with the European Union's GDPR regulations.
One of Suprema's clients
was the United Kingdom's Metropolitan Police,
and at the time of the breach,
the United Kingdom was still part of the European Union.
Furthermore, since the data was exposed
across multiple countries,
data sovereignty and the privacy laws
of a number of countries were in effect.
So remember, privacy risk is the potential
for unauthorized access, misuse,
or disclosure of personal data.
Privacy risks are especially important
to consider when dealing with technologies like biometrics,
where unique personal data such as fingerprints
and facial recognition are involved.
Next, data subject rights provide individuals
with control over their personal information,
allowing them to access, correct, or delete this data.
These types of rights are provided by regulations
like GDPR and CCPA.
Finally, data sovereignty is the principle
that data is governed by the laws
of the country in which it is collected or stored.
So data sovereignty adds complexity
for multinational companies who collect and store data.